This would help onboard contributors and might even help some users understand, why there is so much manual work involved in matching these records with Nix packages.

Best thing I found yet https://www.cve.org/ResourcesSupport/AllResources/CNARules#section_5_CVE_Record_Content